Every region has different rules for how a SaaS deploying LLMs in production must handle data. This guide is the practical playbook — what each regulator actually requires, what Kunavo provides under our DPA, and what you still need to do on your side. It's not legal advice (talk to a lawyer for that), but it's the operational checklist most engineering teams actually need.
The universal four — applies everywhere
- Pseudonymize PII before sending to LLM upstreams — never send raw names, emails, phone numbers, account numbers to a third party. Mask with stable tokens, restore locally
- Sign a DPA / data processing agreement with Kunavo (and inherit our DPAs with Anthropic, OpenAI, Google)
- Maintain an audit trail — request ID, model used, prompt hash, token counts, timestamp. Logs must be deletable for right-to-erasure requests
- Update your privacy policy — explicitly mention AI processing, list sub-processors (Kunavo + upstream providers)
Region-specific requirements
🇪🇺 European Union — GDPR (general)
- Article 28 DPA with Kunavo (template on request via sales@kunavo.com)
- Standard Contractual Clauses (SCC) for transfers to US-based upstreams (Anthropic, OpenAI) — bundled in our DPA
- Records of processing activities (Art. 30) including LLM-specific purposes
- Privacy by design — pseudonymization, data minimization, purpose limitation
- 72-hour breach notification timeline if a security incident affects EU subjects
🇩🇪 Germany — DSGVO + Impressum + TMG
Germany layers extra requirements on top of GDPR:
- Impressum (§ 5 TMG / § 18 MStV) — publish operator identity, address, contact, supervisory authority. Mandatory for German-targeted sites. Kunavo's template at /legal/impressum
- Stricter consent for "non-essential" data processing (Cookie consent, analytics)
- For B2B sales: USt-IdNr (VAT ID) collected via Stripe Tax, reverse-charge applies for intra-EU
DSGVO-konformer LLM-Einsatz has the German-language deep dive with PII-masking code.
🇫🇷 France — RGPD + AI souveraineté concerns
- RGPD is GDPR; same Article 28 DPA applies
- CNIL is the enforcement authority; expect closer scrutiny for health/finance
- For sensitive sectors (public, health, defense): consider EU-only routing — Mistral as upstream, on roadmap via Kunavo
- Privacy policy must be in French if servicing French consumers
Conformité RGPD pour LLM en France for the French deep dive.
🇯🇵 Japan — APPI + tokutei-shoutorihiki
- 特定商取引法 (Act on Specified Commercial Transactions): publish seller info, refund policy, payment methods. Mandatory for B2C in Japan. Kunavo's page at /legal/tokutei-shoutorihiki
- APPI (Personal Information Protection Act) — Japanese DPA via sales@kunavo.com
- Cross-border transfer to US/EU upstreams requires consent or contract
🇰🇷 South Korea — PIPA
- Korean Personal Information Protection Act — one of the strictest globally
- Explicit consent for collection and cross-border transfer
- Korean-language privacy notice if servicing Korean users
🇧🇷 Brazil — LGPD + BACEN for fintech
- LGPD (Lei Geral de Proteção de Dados) mirrors GDPR structurally
- For PIX / payment use cases, BACEN Circulars 4.018 + 3.978 on operational risk apply — document model decisions, allow contestation
- Direito ao esquecimento (Art. 17) — your logs must be deletable
Claude para análise de risco PIX no Brasil covers LGPD + BACEN specifically.
🇹🇷 Turkey — KVKK
- Personal Data Protection Law (KVKK) — DPA structure similar to GDPR
- Foreign data transfer requires explicit consent or KVKK-approved safeguards
- Data controller must register with KVKK if processing exceeds thresholds
Zero Data Retention (ZDR) — when you need it
By default, Anthropic logs prompts for 30 days, Google for 60 days, for abuse monitoring. For high-sensitivity workloads (health, financial, government, EU public sector), you can opt into ZDR:
- Anthropic ZDR: available via Kunavo Enterprise (~$3,000/month minimum). Anthropic deletes prompts within 30 seconds of completion, no upstream training, contractual commitment
- Google Vertex AI ZDR + EU region: routing to europe-west1 (Belgium) or europe-west4 (Netherlands), data stays in EU, ZDR available
- OpenAI ZDR: Enterprise tier only; negotiable through us
Email sales@kunavo.com with your requirements — we'll route you to the right upstream config.
What Kunavo provides vs what stays on your side
| Responsibility | Kunavo | You |
|---|---|---|
| DPA with upstream providers | ✓ | |
| PII pseudonymization in prompts | ✓ | |
| Request-level audit logs | ✓ (Kunavo side) | ✓ (your side) |
| ZDR negotiation with upstream | ✓ (Enterprise) | |
| Privacy policy mentioning sub-processors | ✓ | |
| Right-to-erasure on your data | ✓ | |
| Stripe Tax for regional VAT | ✓ (automatic) |
The 30-minute audit checklist
- Sign DPA with Kunavo — emails sales@kunavo.com
- Add PII pseudonymization step before every LLM call (template code in the region-specific deep dives)
- Confirm your audit log captures request_id, prompt_hash, model, tokens, timestamp — and is deletable
- Update privacy policy: list "Kunavo" + upstream providers as sub-processors, mention purposes (classification, generation, etc.)
- Publish region-specific notices: Impressum (DE), tokutei-shoutorihiki (JP) — Kunavo provides templates at /legal
- If sensitive sector: request ZDR for upstream
- Set monthly review cadence — regulations evolve, vendors evolve, your audit log retention may need adjustment
Don't panic, but don't skip
For most B2C SaaS with no special-category data, the universal four + an updated privacy policy + Kunavo's DPA gets you 95% there. The remaining 5% — sector-specific notices, ZDR, sovereign upstreams — kicks in when you scale or move into regulated industries.
FAQ
Does Kunavo sign a DPA (data processing agreement)?
Yes. Kunavo signs a GDPR Article 28 data processing agreement, and you inherit Kunavo's own DPAs with Anthropic, OpenAI and Google. Standard Contractual Clauses covering transfers to US-based upstreams are bundled into it. Request the template from sales@kunavo.com.
How long do LLM providers retain prompts by default?
By default Anthropic logs prompts for 30 days and Google for 60 days, for abuse monitoring. Zero Data Retention removes that window but has to be arranged per upstream.
How do I get Zero Data Retention (ZDR) for LLM API calls?
Anthropic ZDR is available through Kunavo Enterprise from roughly $3,000/month; Anthropic then deletes prompts within 30 seconds of completion, with no upstream training and a contractual commitment. Google Vertex AI offers ZDR with EU-region routing to europe-west1 (Belgium) or europe-west4 (Netherlands). OpenAI ZDR is Enterprise-tier only.
What is the minimum compliance work for shipping an LLM feature?
Four things apply in every region: pseudonymize PII before it reaches an LLM upstream, sign a data processing agreement, keep an audit trail (request id, model, prompt hash, token counts, timestamp) that can be deleted for right-to-erasure requests, and update the privacy policy to name AI processing and list sub-processors. For most B2C SaaS with no special-category data, those four plus a DPA cover about 95% of the requirement.
Which countries require notices beyond GDPR for an AI product?
Germany requires an Impressum under § 5 TMG / § 18 MStV. Japan requires a 特定商取引法 notice publishing seller identity, refund policy and payment methods for B2C. South Korea's PIPA requires a Korean-language privacy notice and explicit consent for cross-border transfer. Brazil's LGPD adds BACEN Circulars 4.018 and 3.978 for PIX and payment use cases. Turkey's KVKK requires explicit consent or KVKK-approved safeguards for foreign data transfer.